.TH "" "" "" "" ""
.SS NAME
.PP
csysdig \- the ncurses user interface for sysdig
.SS SYNOPSIS
.PP
\f[B]csysdig\f[] [\f[I]option\f[]]...
[\f[I]filter\f[]]
.SS DESCRIPTION
.PP
csysdig exports sysdig\[aq]s functionality through an intuitive and
powerful ncurses\-based user interface.
.PP
csysdig has been designed to mimic tools like \f[B]top\f[] and
\f[B]htop\f[], but it offers richer functionality, including:
.IP \[bu] 2
Support for both live analysis and sysdig trace files.
Trace files can come from the same machine or from another machine.
.PD 0
.P
.PD
.IP \[bu] 2
Visibility into a broad range of metrics, including CPU, memory, disk
I/O, network I/O.
.PD 0
.P
.PD
.IP \[bu] 2
Ability to observe input/output activity for processes, files, network
connections and more.
.PD 0
.P
.PD
.IP \[bu] 2
Ability to drill down into processes, files, network connections and
more to further explore their behavior.
.PD 0
.P
.PD
.IP \[bu] 2
Full customization support.
.PD 0
.P
.PD
.IP \[bu] 2
Support for sysdig\[aq]s filtering language.
.PD 0
.P
.PD
.IP \[bu] 2
Container support by design.
.PP
csysdig works on any terminal, and has support for colors and mouse
input.
.PP
\f[B]Views\f[]
.PP
csysdig is based on the concept of \[aq]views\[aq], little Lua scripts
that determine how metrics are collected, processed and represented on
screen.
Including a new visualization to csysdig doesn\[aq]t require to update
the program, and is simply a matter of adding a new view.
Views rely on the sysdig processing engine, and this means that they can
include any sysdig filter field.
Views are located in the sysdig chisel directory path, usually
\f[I]/usr/share/sysdig/chisels\f[] and \f[I]~/.chisels\f[].
.SS BASIC USAGE
.PP
Here are some basic tips to get you started with sysdig:
.IP "1." 3
If you run csysdig without arguments, it will display live system data,
updating every 2 seconds.
To analyze a trace file, use the \-r command line flag.
.PD 0
.P
.PD
.IP "2." 3
You can switch to a different view by using the \f[I]F2\f[] key.
.PD 0
.P
.PD
.IP "3." 3
You can to drill down into a selection by clicking \f[I]enter\f[].
You can navigate back by typing \f[I]backspace\f[].
.PD 0
.P
.PD
.IP "4." 3
You can observe input/output for the currently selected entity by typing
\f[I]F5\f[]
.PD 0
.P
.PD
.IP "5." 3
You can see sysdig events for the currently selected entity by typing
\f[I]F6\f[]
.SS DRILLING DOWN
.PP
You drill down by selecting an element in a view and then clicking
\f[I]enter\f[].
Once inside a selection, you can switch to a different view, and the new
view will be applied in the context of the selection.
For example, if you drill down into a process called foo and then switch
to the \f[I]Connections\f[] view, the output will include only the
connections made or received by \f[I]foo\f[].
.PP
You can drill down multiple times, by keeping clicking \f[I]enter\f[].
For example, you can click on a container in the \f[I]Containers\f[]
view to get the processes running inside it, and then click on one of
the processes to see its threads.
.SS CONTAINERS SUPPORT
.PP
Starting csysdig with the \-pc command line switch will cause many of
the views to include additional container information.
For example, the \f[I]Processes\f[] will include the columns with the
container the process belongs to.
Similarly, the \f[I]Connections\f[] view will show which container each
connection belongs to.
.SS INTERACTIVE COMMANDS
.SS Views Window
.PP
\f[B]Arrows, PgUP, PgDn, Home, End\f[]
.PD 0
.P
.PD
Change the selection and scroll view content, both vertically and
horizontally.
.PP
\f[B]Enter\f[]
.PD 0
.P
.PD
Drill down into the currently highlighted entry.
.PP
\f[B]Backspace\f[]
.PD 0
.P
.PD
Navigate back to the previous view.
.PP
\f[B]F2\f[]
.PD 0
.P
.PD
Show the view picker.
This will let you switch to another view.
.PP
\f[B]CTRL+F /\f[]
.PD 0
.P
.PD
Incremental search in the list of view entries.
.PP
\f[B]F4\f[]
.PD 0
.P
.PD
Incremental filtering of the view entries.
.PP
\f[B]F5, e\f[]
.PD 0
.P
.PD
\[aq]echo FDs\[aq] for the selection, i.e.
view FD input/output for the currently highlighted entry.
.PP
\f[B]F6, d\f[]
.PD 0
.P
.PD
\[aq]dig\[aq] into the selection, i.e.
view sysdig events for the currently highlighted entry.
Refer to the sysdig man page to learn about interpreting the content of
this window.
.PP
\f[B]F7\f[]
.PD 0
.P
.PD
Show the help page for the currently displayed view.
.PP
\f[B]F10, q\f[]
.PD 0
.P
.PD
Quit.
.PP
\f[B]DEL, c\f[]
.PD 0
.P
.PD
For views that are listing elements without aggregating them by key
(identifiable by yellow column headers), this command clears the view
content.
.PP
\f[B]p\f[]
.PD 0
.P
.PD
Pause screen updates.
.PP
\f[B]F1, h, ?\f[]
.PD 0
.P
.PD
Show the help screen.
.SS Echo and sysdig Windows
.PP
\f[B]Arrows, PgUP, PgDn, Home, End\f[]
.PD 0
.P
.PD
Scroll the page content.
.PP
\f[B]Backspace\f[]
.PD 0
.P
.PD
Navigate back to the previous view.
.PP
\f[B]CTRL+F /\f[]
.PD 0
.P
.PD
Search inside the window content.
.PP
\f[B]F3\f[]
.PD 0
.P
.PD
Find Next.
.PP
\f[B]F2\f[]
.PD 0
.P
.PD
Chose the output rendering format.
Options are \[aq]Dotted ASCII\[aq] (non\-printable binary bytes are
rendered as dots), \[aq]Printable ASCII\[aq] (non\-printable binary
bytes are not included and line endings are rendered accurately) and
\[aq]Hex\[aq] (dotted ASCII representation is included together with the
Hexadecimal rendering of the buffers).
.PP
\f[B]DEL, c\f[]
.PD 0
.P
.PD
Clear the screen content.
.PP
\f[B]p\f[]
.PD 0
.P
.PD
Pause screen updates.
.PP
\f[B]CTRL+G\f[]
.PD 0
.P
.PD
Go to line.
.SS MOUSE USAGE
.IP \[bu] 2
Clicking on column headers lets you sort the table.
.PD 0
.P
.PD
.IP \[bu] 2
Double clicking on row entries performs a drill down.
.PD 0
.P
.PD
.IP \[bu] 2
Clicking on the filter string at the top of the screen (the text after
\[aq]Filter:\[aq]) lets you change the sysdig filter and customize the
view content.
.PD 0
.P
.PD
.IP \[bu] 2
You can use the mouse on the entries in the menu at the bottom of the
screen to perform their respective actions.
.SS COMMAND LINE OPTIONS
.PP
\f[B]\-d\f[] \f[I]period\f[], \f[B]\-\-delay\f[]=\f[I]period\f[]
.PD 0
.P
.PD
Set the delay between updates, in milliseconds (by default = 2000).
This works similarly to the \-d option in top.
.PP
\f[B]\-E\f[], \f[B]\-\-exclude\-users\f[]
.PD 0
.P
.PD
Don\[aq]t create the user/group tables by querying the OS when sysdig
starts.
This also means that no user or group info will be written to the
tracefile by the \-w flag.
The user/group tables are necessary to use filter fields like user.name
or group.name.
However, creating them can increase sysdig\[aq]s startup time.
.PP
\f[B]\-h\f[], \f[B]\-\-help\f[]
.PD 0
.P
.PD
Print this page
.PP
\f[B]\-l\f[], \f[B]\-\-list\f[]
.PD 0
.P
.PD
List all the fields that can be used in views.
.PP
\f[B]\-\-logfile\f[] \f[I]file\f[]
.PD 0
.P
.PD
Print program logs into the given file.
.PP
\f[B]\-N\f[]
.PD 0
.P
.PD
Don\[aq]t convert port numbers to names.
.PP
\f[B]\-n\f[] \f[I]num\f[], \f[B]\-\-numevents\f[]=\f[I]num\f[]
.PD 0
.P
.PD
Stop capturing after \f[I]num\f[] events
.PP
\f[B]\-pc\f[], \f[B]\-pcontainers\f[]_
.PD 0
.P
.PD
Instruct csysdig to use a container\-friendly format in its views.
This will cause several of the views to contain additional
container\-related columns.
.PP
\f[B]\-r\f[] \f[I]readfile\f[], \f[B]\-\-read\f[]=\f[I]readfile\f[]
.PD 0
.P
.PD
Read the events from \f[I]readfile\f[].
.PP
\f[B]\-s\f[] \f[I]len\f[], \f[B]\-\-snaplen\f[]=\f[I]len\f[]
.PD 0
.P
.PD
Capture the first \f[I]len\f[] bytes of each I/O buffer.
By default, the first 80 bytes are captured.
Use this option with caution, it can generate huge trace files.
.PP
\f[B]\-v\f[] \f[I]view\f[]id_, \f[B]\-\-views\f[]=\f[I]view\f[]id_
.PD 0
.P
.PD
Run the view with the given ID when csysdig starts.
View IDs can be found in the view documentation pages in csysdig.
Combine this option with a command line filter for complete output
customization.
.PP
\f[B]\-\-version\f[]
.PD 0
.P
.PD
Print version number.
.SS FILTERING
.PP
Similarly to what you do with sysdig, you can specify a filter on the
command line to restrict the events that csysdig processes.
To modify the filter while the program is running, or to add a filter at
runtime, click on the filter text in the UI with the mouse.
.SS CUSTOMIZING CSYSDIG
.PP
csysdig is completely customizable.
This means that you can modify any of the csysdig views, and even create
your own views.
Like sysdig chisels, csysdig views are Lua scripts.
Full information can be found at the following github wiki page:
<https://github.com/draios/sysdig/wiki/csysdig-View-Format-Reference>.
.SS FILES
.PP
\f[I]/usr/share/sysdig/chisels\f[]
.PD 0
.P
.PD
The global views directory.
.PP
\f[I]~/.chisels\f[]
.PD 0
.P
.PD
The personal views directory.
.SS AUTHOR
.PP
Draios Inc.
(dba Sysdig) <info@sysdig.com>
.SS SEE ALSO
.PP
\f[B]sysdig\f[](8), \f[B]strace\f[](8), \f[B]tcpdump\f[](8),
\f[B]lsof\f[](8)
